CVE-2026-54278: AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
Summary
During cleanup it is possible for a compressed request body to be decompressed into memory in one chunk.
Impact
An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case).
Workaround
Disable compression if unable to upgrade.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232
Other sources
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.14.1 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.14.1Patch 4f7480e474cccc6a8cc2c92ad3f17a31dedf8232 - Configuration
Disable compression if you are unable to upgrade, to prevent attackers from sending compressed payloads that could decompress into memory.
aiohttp compression = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54278?
CVE-2026-54278 has a risk rating of 26.
How do I fix CVE-2026-54278?
Currently, the fix for CVE-2026-54278 is not specified, so keep an eye on official updates from the aiohttp maintainers.
What impact does CVE-2026-54278 have on my application?
CVE-2026-54278 may allow an attacker to exploit compressed payloads, potentially leading to Denial of Service (DoS) conditions.
Which software is affected by CVE-2026-54278?
CVE-2026-54278 affects the pip/aiohttp software.
When was CVE-2026-54278 published?
CVE-2026-54278 was published on June 15, 2026.